oalabs / blobrunner Goto Github PK

--nopause flag doesn't work for x64bit program.

should be

#ifdef _WIN64
printf(" [] Thread Entry: 0x%016I64x\n", shell_entry);
#else
printf(" [] Thread Entry: 0x%08I32x\n", shell_entry);
#endif // _WIN64

Looks like __asm is not supported on x64, can you help?

Could be user error or possible bug. When I go to the offset specified in the Base, IDA view > segments the base addr is only listed as the end of the allocated memory never at the start for the shellcode.
shellcode3_actual_meterpreter.zip

passwd - infected

In the previous versions, the shellcode entrypoint address is printed before pressing any key to jump to the shellcode. This allows us to set a breakpoint at the shellcode entrypoint before proceeding on.

In the latest version, the shellcode entrypoint address is printed after pressing any key as shown in the screenshot above.

--autobreak flag provide the injection of "int 3" instruction into the shellcode, what could corrupt the shellcode execution.

Possible solution:
set the breakpoint before the jump to shellcode execution.

printf(" [*] Navigate to the Thread Entry and set a breakpoint. Then press any key to resume the thread.\n",entry);

This line is missing a format specifier for entry.

The nopause option does not seem to be useful, I'd rather prepend an INT 3 instruction that forces OllyDBG to stop

Can you do something similar to this?

LPVOID process_file(char* inputfile_name){
        ...
	buffer=(char *)malloc(fileLen+1+4); //Create Buffer
	for (i = 0; i < 3; i ++) {
		buffer[i] = 0x90;
	}
	buffer[3] = 0xCC;
	fread(buffer+4, fileLen, 1, file);  //Read file to buffer
	fclose(file);                     //Close file handle
        ...

blobrunner incorrectly assumes the offset input is in base 16 or hex. For example, the two commands would jump to different offsets, even though they are equivalent.

blobrunner.exe blah.bin --offset 0xC000 
blobrunner.exe blah.bin --offset 3072

Provide the code refactoring:

• make code bit version independent
• avoid program crashes on shell code execution
• avoid memory leaks
• code refactoring